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1.  Introduction 

A  theory  of  possibility  was  first  proposed  by  Zadeh  in  1978  (Reference  1)  as 
a  means  to  quantify  judgement.  The  theory  provides  a  formalism  to  treat  vague, 
imprecise  or  incomplete  information  which  is  different  from  the  approaches  by 
probability  theory  and  interval  analysis.  Each  of  these  three  theories  emphasize 
different  aspects  of  vagueness  and  thus  complement  each  other.  Possibility  theory 
is  particularly  adequate  for  the  development  of  vulnerability  measures  because, 
first,  the  basic  information  in  vulnerability  problems  is  typically  vague  but  not 
random  and,  second,  the  theory  provides  a  natural  means  to  rank  the  relative 
outcomes  from  a  combination  of  targets  and  threats.  A  comprehensive  summary  of 
the  present  status  of  possibility  theory  is  given  in  Reference  2. 

The  relation  between  possibility  theory  and  interval  analysis  is  easy  to 
describe  because  interval  analysis  is  a  limit  case  of  possibility  theory.  More 
precisely,  for  interval  analysis  one  assumes  that  an  event  either  does  or  does  not 
belong  to  a  certain  category,  whereas  in  possibility  theory  the  event  is  allowed  to 
belong  more  o;  less  to  the  category.  This  is  expressed  by  assigning  to  the  event 
and  to  its  contrary  a  lesser  or  larger  degree  of  possibility  (between  0  and  1).  These 
two  possibilities  are  only  weakly  related:  if  an  event  is  possible,  then  this  does  not 
prevent  its  contrary  to  be  possible,  too.  (The  law  of  the  excluded  middle  is 
weakened  in  the  context  of  possibility  measures).  The  complement  (with  respect 
to  1)  of  the  degree  of  possibility  of  the  contrary  event  can  be  interpreted  as  the 
necessity  (certainty)  of  the  event  itself.  Thus,  in  possibility  theory  an  event  is 
.*hu;a:t"ri — 1  v,y  tWo  pos?iu:lity  mea^^e'  —  a  decree  of  possibility  II  and  a  degree 
of  necessity  N. 

The  relation  between  possibility  theory  and  probability  theory  is  more 
esoteric.  They  are  connected  via  the  concepts  of  plausibility  and  belief  within  the 
framework  of  Derapster-Shaf er  theory.  In  order  to  handle  incomplete  data 
Dempster  introduced  the  concepts  of  iower  and  upper  nrr>bsb:1;ti**«  The  actual 
probability  of  an  event  (with  complete  and  disjoint  elements)  falls  between  these 
limits.  If  the  data  are  crisp  and  certain  other  requirements  are  satisfied,  then  the 
lower  probability  (belief)  corresponds  to  a  degree  of  necessity  and  the  upper 
probability  (plausibility)  corresponds  to  a  degree  of  possibility.  Hence,  if  it  makes 
sense  to  assign  a  probability  to  an  event,  then  it  likely  has  a  value  somewhere 
between  the  degrees  of  necessity  and  possibility.  The  generalization  which  is 
achieved  by  using  possibilistic  instead  of  probabilistic  measures  provides  a  natural 
way  to  handle  data  which  are  not  exact,  but  given,  e.g.  by  an  interval.  Probability 
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measures  generally  apply  to  precise  but  differentiated  items,  whereas  possibility 
measures  are  more  adequate  for  the  representation  of  imprecise  and  possibly 
coherent  information.  The  most  striking  difference  between  probability  and 
possibility  is  that  the  probability  P(A)  of  an  event  completely  determines  the 
probability  P{A)  of  its  contrary:  P{A )  -  1  —  P(A).  The  corresponding  possibility 
measures  satisfy  only  the  relations  I1(A)  +  I1(A)^1  and  N  (A)-r  N  (A)s  1 . 

In  applications  to  vulnerability  analysis  one  is  particularly  interested  in 
possibilistic  pattern  matching.  Indeed,  in  order  to  determine  whether  a  system 
component  e*£  is  killed  in  the  presence  of  a  threat  tiT ,  one  might  define  in  the 
event  space  G  -  (£  x  T)  a  set  K  of  all  such  events  for  which  the  system  component  is 
assumed  to  be  killed,  and  then  check  whether  the  given  element  g=(e,r)  belongs  to 
K .  If  the  descriptions  of  g  and  K  are  vague  then  g  might  match  an  element  of  K  to 
a  larger  or  lesser  degree.  Possibility  theory  allows  one  to  associate  with  such  a 
partial  matching  a  degree  of  possibility  II*(£)  and  a  degree  of  necessity  N^g)  that 
e  is  killed.  Once  II *  and  Njf  are  known  for  all  components  of  a  system,  then  the 
corresponding  Ilg  and  for  the  whole  system  are  computed  by  aggregation  of  the 
individual  results  using  logical  "and/or"  rules  in  a  fault  tree. 

This  report  is  a  short  description  of  the  concepts  and  techniques  that  are 
needed  for  the  application  of  possibility  theory  to  vulnerability  problems.  In 
Section  2  we  discuss  the  computation  of  kill  possibility  measures  for  an  elementary 
system  component.  Section  3  outlines  the  aggregation  of  elementary  possibilities  to 
obtain  the  possibility  measures  for  a  kill  of  a  system. 

2.  Possibilistic  Vulnerability  Criterions. 

2.1.  Crisp  Kill  Criterions. 

To  determine  the  vulnerability  of  a  system,  generally  the  system  is  broken 
down  into  components,  which  are  in  turn  broken  down  into  subcomponents,  etc. 
until  at  the  lowest  level  one  has  a  »et  of  elementary  components .  The  state  of  each 
elementary  component  is  assumed  to  be  either  "intact"  or  "killed",  and  is  indicated 
by  a  1  or  0,  respectively,  in  a  state  vector  where  each  vector  component  represents 
the  state  of  an  elementary  system  component.  The  state  of  the  system  is  calculated 
from  the  binary  state  vector  of  the  elementary  components  by  logical  aggregation 
which  successively  yields  state  indicators  for  higher  level  system  compr*T',*«ts.  At 
those  levels,  the  state  indicators  generally  can  have  values  in  the  interval  [0,1] 
indicating  the  level  of  operability  of  e»oh  system  component.  (Alternatively  the 
computations  might  yield  probabilities  of  damage.  We  shall  not  discuss  the  pro  and 
contra  of  various  methods  of  aggregation  and/or  interpretation  of  the  results.  Our 
interest  is  in  the  general  approach  which  consists  of  an  estimation  of  the  state  of 
low  level  components  and  aggregation  to  obtain  the  state  of  higher  level 
components).  The  final  result  of  the  aggregation  algebra  are  indicators  of  the  state 


of  the  who)*-  jitera.  If  the  system  encounters  a  specific  threat  then  the  state  vector 
of  the  el.  ^entary  components  changes  and  the  aggregation  yields  state  indicators 
of  tK'  tew  state  of  the  system  due  to  the  threat.  Hence  one  basic  problem  in 
vulnerability  estimates  is  the  definition  of  a  threshold  for  the  threat  above  which 
the  state  of  an  elementary  component  is  affected. 

Let  the  kill  criterion  of  an  elementary  component  be  expressed  by  the 
equation 

CM^O,  (2.1) 

where  e  is  a  parameter  describing  the  component  and  r  i:>  a  parameter  which 
specifies  the  threat.  C(e,t)  is  a  decision  function  (in  a  probabilistic  model  it  may 
also  depend  on  random  variables).  Let  it  determine  the  outcome  of  a  pairing  of  e 
and  f  by  the  convention 


or 


C(e.t)  <0  -*  component  intact 

C(e,t )  2r  0  -*  component  killed 


5  1  (e.t) 


l  S°'(e) 

{  o 


if  C(e,t)  <  0 

if  C(e,t)>(j 


(2.2) 


(2.3) 


where  5  (if)  and  S  *  (e.t)  are  the  states  of  the  elementary  component  before  and 
after  application  of  the  threat,  respectively. 


We  illustrate  in  Figure  1  the  notion  of  a  decision  function  in  a  case  where  e 
and  r  are  scalar  parameters,  and  the  zero  level  of  the  decisi  >n  function  defines  a 
curve  in  the  e.r-plane.  A  specific  combination  of  component  md  threat  is  given  by 
particular  values  for  e  and  r  which  define  a  point  in  the  event  olane.  Depending  on 
the  location  of  that  point  with  respect  to  the  decision  curve  (1=0  the  component  is 
assumed  to  be  either  intact  or  killed. 


Several  generalizations  of  this  situation  are  needed  in  piactice  aside  from  the 
obvious  that  e  and  r  usually  are  vectors.  First,  the  descriptors  e  and  t  might  be 
known  only  approximately  and,  second,  the  decision  function  C  might  be  only 
defined  within  some  bounds.  We  assume  that  these  inaccuracies  are  defined  in 
terms  of  fuzzy  numbers  and  functions,  that  is,  by  membership  functions  which 
express  the  possibility  of  the  occurrence  of  a  specific  threat  r  and  target  element  e, 
and  which  define  possible  locations  of  the  decision  bound  C(e,r)=0  in  the  event 
space 

As  an  example,  assume  that  the  caliber  of  a  threat  projectile  is  known  to  be 
within  certain  bounds.  Then  we  assign  positive  membership  values  (less  or 
equal  1)  to  calibers  within  these  bounds  and  zero  membership  values  to  all  other 
calibers.  These  membership  values  then  define  the  fuzzy  set  "caliber  of  the 
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threat'.  Approximate  target  descriptions  are  handled  correspondingly. 
Approximate  decision  functions  define,  instead  of  a  crisp  decision  surface  as  a 
solution  of  the  equation  C(e,f)=0.  a  fuzzy  surface  as  the  solution  of  a  fuzzy 
equation  which  represents  a  gradual  transition  between  "kill"  and  "intact" 
situations.  We  assume  that  the  gradual  transition  again  is  expressed  by  a 
corresponding  membership  function.  An  example  of  such  a  representation  is  given 
in  the  next  section. 

2.2.  Possibihstic  Decision  Bounds. 

One  can  treat  the  kill  criterion  (2.2)  as  a  pattern  matching  problem  because 
the  condition  C(<,r)20  defines  in  the  event  space  G-(ExT)  a  subset  K  of 
unfavorable  combinations  of  e  and  t.  Given  a  particular  event  g=(e,t)  one  is 
interested  to  determine  whether  this  datum  matches  any  of  the  elements  in  K,  that 
is,  whether  g(K.  This  is  a  pattern  matching  problem.  If  g  and/or  K  are  only 
approximately  given,  then  a  matching  to  a  larger  or  lesser  degree  is  a  natural 
outcome.  Measures  of  the  degree  of  matching  are  provided  by  the  concepts  of 
possibility  theory  (Reference  3).  In  this  section  we  consider  the  special  case  where 
the  decision  function  is  fuzzy  and  the  events  g  are  crisp.  In  the  next  section  we 
shall  consider  the  general  case  where  the  decision  function  as  well  as  the  events  are 
fuzzy. 

We  indicate  fuzzy  functions  by  a  tilde  and  let  the  decision  be  specified  by  a 
fuzzy  function  C(e,t).  The  decision  equation  C(e,/)=0  defines  in  the  event  space  a 
fuzzy  surface  (Reference  4)  which  is  the  fuzzy  bound  of  the  set  K  containing  the 
"kill"  patterns.  (The  set  is  fuzzy  because  its  boundary  is  fuzzy).  Figure  2  shows  a 
fuzzy  bound  in  a  one-dimensional  event  space,  where  C  =  0  defines  a  fuzzy 
number,  or  a  "fuzzy  point"  as  a  fuzzy  segment  of  the  number  line.  For 
convenience  we  shall  assume  in  our  examples  that  fuzzy  numbers  have  trapezoidal 
membership  functions  as  shown  in  the  figure.  The  interval  [x;,*;]  *s  called  the  core 
of  the  number,  and  the  interval  [xi~ xj  ,  x4]  is  called  the  support  of  the 

number.  Fuzzy  numbers  x  with  this  type  of  membership  functions  can  be 
conveniently  represented  by  the  quadruple  (xj.xt.xj.x,*).  If  the  number  is  crisp,  say 
X(j,  then  its  representation  is  (x0,x0,0,0).  In  the  present  example  the  fuzzy  number 
in  Figure  2  is  meant  to  be  the  solution  of  a  fuzzy  equation  C(x)  =  0.  We  assume 
that  there  exists  a  corresponding  crisp  equation  C(x)~  0  which  has  a  solution  x0 
within  the  core  of  the  fuzzy  solution. 

Let  fj,v(x)  be  the  membership  function  of  a  fuzzy  number  y.  The  degree  of 
possibility  that  a  crisp  number  a  is  smaller  than  y  (is  to  the  left  of  y)  is  a  fuzzy 
number  with  the  membership  function  (Reference  2) 
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Pasr(fl)  =  SUP  m(5)  •  (2  4) 

{So 

The  degree  of  necessity  that  a  is  smaller  than  y  is  defined  by  the  membership 
function 

vasr(«)  =  inf  (l-»i;«))  •  (2.5) 

Figure  3  shows  these  possibility  and  necessity  membership  functions  for  a  fuzzy 
bound  y  with  the  membership  function  shown  in  Figure  2.  If  the  oound  y  is  a  crisp 
number  then  there  is  only  one  crisp  segment  of  the  number  line  where  the  crisp 
numbers  are  less  than  y.  In  contrast,  if  the  bound  is  fuzzy  then  there  are  two  fuzzy 
segments,  defined  by  the  membership  functions  p  and  v  ,  and  representing  the 
possibility  and  necessity,  respectively,  that  a  crisp  number  is  less  than  y. 

The  generalization  to  a  multi-dimensional  situation  is  simple.  Let  the  bound 
of  K  be  given  by  a  membership  function  „0(e.t),  and  let  the  corresponding  crisp 
equation  C(e,r)  =  0  define  a  crisp  decision  bound  within  the  core  of  Then 

the  possibility  that  the  pairing  g-  (e,t)  results  in  a  kill  of  the  component  e  is 

|  0  if  C(e,r)  <  0  , 

pv(e,r)  =  pg,g(e,t)  =  ^  j  if  C(e,r)  a  0  .  t2'6) 

The  necessity  that  the  pairing  g  results  in  a  kill  of  e  is 

0  if  C(e,»)  <  0  , 

v*(*,r)  =  vg<£(e,t)  =  {  1  -  iic-cU-O  if  C(e,r)  &  0  . 

The  membership  functions  p*  and  v*  define  in  the  event  space  the  fuzzy 
subsets  of  possibility  and  necessity,  respectively,  that  a  crisp  event  corresponds  to  a 
kill.  We  call  these  subsets  AT  and  If  the  decision  criterion  is  crisp  then  the 

subsets  are  identical  ordinary  crisp  subsets. 

2.3.  Posaibilistic  Events. 

We  now  consider  the  case  where  the  component  as  well  as  the  threat  are 
given  by  sets  of  possible  values  of  e  and  t.  Let  the  functions  -ir^e)  and  TTj-(t)  be 
the  degrees  of  possibility  that  e  and  t  actually  occur.  Given  those  possibilities,  one 
would  like  to  know  the  possibility  and  necessity  that  the  event  g=  t«,r)  corresponds 
to  a  kill  situation. 

In  the  event  space  G  the  possibility  of  the  event  g=  (e,f)  has  the  membership 
function 

TTG(e,r)  =  rain  {  iTr(r)  }  .  (2.8) 
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If  t  and  r  are  scalars,  and  ir E(e)  and  iTj-O)  are  trapezoidal  functions  then  it G(e,r) 
is  a  frustrated  pyramid  in  the  e,r, it -space  as  shown  in  Figure  4.  ttg(<?, t)  defines  a 
fuzzy  subset  g  in  the  event  space.  In  Figure  4  this  subset  is  a  fuzzy  point  in  a  two- 
dimensional  space.  The  possibility  that  this  point  corresponds  to  a  kill  situation  is 
measured  by  the  degree  of  possibility  that  g  matches  a  point  within  the  subset  AT jj 
def'ned  by  C(e,t)>0.  That  possibility  is  calculated  as  follows  (Ref.  2,  p.25; 
Ref.  3,  p.316): 


njr(?)  =  nfcjp  =  sup  min  {  pK(e,t)  }  ,  (2.9) 

e.t 

where  is  the  membership  function  of  the  subset  AT jj  .  The  necessity  of  a  match  is 
calculated  by  using  the  membership  function  vK  of  the  subset  and  the  formula 

Njc(g)  =  N =  1  “  sup  min  {  irG(*,f),  l-vA-(e,f)  }  .  (2.10) 

t  J 

Figure  5  shows  a  number  of  possible  situations  in  the  case  where  the  event 
space  is  two-dimensional  and  the  decision  function  C(e,f)  is  crisp.  The  event  is 
given  by  a  membership  pyramid  similar  to  that  in  Figure  4.  A  number  of  different 
locations  of  the  decision  curve  are  shown  as  dashed  lines.  The  degrees  of 
possibility  and  necessity  that  the  event  belongs  to  the  subset  C^O  depends  on  the 
relative  locations  of  event  and  decision  curve,  and  the  decision  curves  are  labeled 
correspondingly.  The  figure  shows  how  to  interpret  the  possibility  and  necessity 
measures.  The  possibility  is  positive  if  a  part  of  the  support  of  g  is  inside  K,  and  it 
equals  1  if  at  least  a  part  of  the  core  is  inside  K.  The  necessity  is  zero  unless  the 
whole  core  is  inside  K .  It  equals  1  only  if  the  whole  support  of  g  is  inside  K . 

Trapezoidal  membership  functions  are  well  suited  for  the  discussion  and 
illustration  of  possibilistic  concepts.  However,  a  restriction  to  trapezoidal  fuzzy 
numbers  has  also  practical  numerical  advantages  because  with  this  restriction  and  a 
decision  function  which  yields  the  values  of  p^(e,t)  and  v^-(e,f)  for  any  set  (e,t) 
one  can  compute  II and  by  fast  search  algorithms. 

2.4.  Example. 

We  present  an  example  of  combined  kill  criterions  for  an  armor  plate 
subjected  to  blast.  For  this  example,  we  consider  two  types  of  damage:  a  failure 
of  the  plate  and  a  deflection  greater  than  a  threshold.  The  plate  (or  a  component 
behind  the  olate)  is  "killed"  if  either  of  these  criterions  is  satisfied. 

Both  criterions  are  formulated  in  terms  of  the  following  dimensionless 
variables. 
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A  = 


z 


(2.11) 


where  z  =  deflection  of  the  plate  after  loading, 
s  =  distance  of  the  charge  from  the  plate, 

E  =  energy  of  the  charge, 
h  =  thickness  of  the  plate, 
ctv  =  yield  stress  of  the  plate’s  material. 

Let  the  failure  bound  be  given  by  the  equation  (Reference  5) 

Cj  =  B  -  Bd  =  0  ,  (2.12) 

let  the  deflection  be  given  by  the  function 

-  =  a  +  b  B1S  ,  (2.13) 

s 

and  let  the  damage  criterion  due  to  a  large  deflection  be  given  by  the  equation 

C2  =  a  +  b  BlS  -  A  =  0  ,  (2.14) 

where  A  =  zcrit/s  is  a  critical  value  for  the  deflection. 

In  the  event  space,  the  component  (the  plate)  is  represented  by  the  vector 

e  =  (  hu}  .  zcn,  )  (2.15) 

and  the  threat  is  define  1  by  the  vector 

t  =  (£,  *  )  ■  (2-16) 

Hence,  the  event  space  is  four-dimensional  in  this  example.  The  subset  of  killed 
components  in  the  event  space  is  defined  by 

(<?,»)  €  K  if  Ci((,t)  2  0  ,  or  C;(f.i)  2:  0  .  (2.17) 

The  analysis  can  be  simplified  by  mapping  the  four-dimensional  event  space 
to  a  two-dimensional  space  with  the  dimensionless  coordinates  A  and  B.  The 
mapping  is  provided  by  eq.  (2.11).  The  parameters  a,  b  and  the  exponent  1.5  in 
eq.  (2.14),  and  the  parameter  B0  in  eq.  (2.12)  are  fuzzy  numbers.  Therefore  the 
decision  bound  defined  by  eq.  (2.17)  is  a  fuzzy  curve  in  the  BM-plane.  It  is  shown 
in  Figure  6.  The  support  of  the  decision  bound  is  the  area  between  the  two 
outermost  curves.  The  core  of  the  bound  is  the  curve  running  approximately  in  the 
center  between  the  support  boundaries.  It  corresponds  to  the  line  hc«q=1  (the 
crisp  solution  of  the  decision  equations).  The  straight  vertical  lines  in  the  top  part 
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of  the  figure  represent  the  failure  bound  (2.12)  and  the  curved  part  of  the  bound 
represents  eq.  (2.14).  Events  corresponding  to  a  kill  of  the  component  are  in  the 
lower  right  part  of  the  figure.  In  that  area  the  membership  values  of  the  possibility 
of  kill,  p*,  and  necessity  of  kill,  vK,  both  equal  1.  Moving  to  the  left,  the  necessity 
membership  v%  reduces  to  zero  at  the  center  curve,  at  which  point  p %  starts  to 
decline  and  reaches  zero  at  the  leftmost  curve.  The  two  surfaces  px(B,A)  and 
vk(B,A)  define  for  a  crisp  event  ( B,A )  the  degrees  of  possibility  and  necessity  of 
kill. 

In  real  applications,  the  input  values  of  A  and  B  are  fuzzy.  For  instance, 
when  one  computes  the  vulnerability  of  a  given  vehicle,  then  one  might  have  the 
exact  values  of  the  parameters  ha v  and  zcri},  but  only  a  possibility  membership 
function  for  the  parameters  E  and  j  of  the  threat.  Then  both  coordinates  A  and  B 
of  the  event  are  fuzzy  because  both  depend  on  the  fuzzy  threat  parameters. 
Moreover,  because  A  as  well  as  B  depend  on  the  same  parameter  s  of  the  threat 
they  are  "interactive"  in  the  terminology  of  fuzzy  sets.  Figure  7  shows  three 
examples  of  such  fuzzy  events.  We  have  assumed  in  all  three  cases  the  same  fuzzy 
value  E  of  the  energy  of  the  charge  and  varied  its  distance  I  from  case  to  case  by 
the  (crisp)  factor  1.32.  Because  the  two  coordinates  B  and  A  of  the  events  are 
interactive,  the  supports  and  cores  of  the  events  resemble  slanted  parallelograms 
instead  of  being  rectangles  as  in  Figure  4.  The  boundaries  of  the  decision  bound 
from  Figure  6  are  plotted  in  Figure  7  as  dashed  curves.  One  observes  that  the 
degrees  of  possibility  and  necessity  of  kill  increase  as  the  distance  between  the 
charge  and  target  decreases,  that  is,  as  the  event  moves  to  the  right  and  into  the 
subset  corresponding  to  C>0. 


3.  Aggregation  of  Possibilistic  Measures. 

Section  2  describes  the  computation  of  the  degrees  of  possibility  and  necessity 
that  an  elementary  system  component  is  killed.  The  corresponding  indicators  for 
higher  level  components  and  for  the  whole  system  are  computed  by  aggregation 
operations  on  the  vectors  of  state,  possibility  and  necessity  of  the  elementary 
system  components.  Now  we  shall  discuss  such  aggregations. 

The  initial  state  of  an  elementary  system  component  e<E  is  given  by  its  state 
value  5(0l(e)  which  is  either  0  or  1 .  The  threat  defines  an  event  space  G  =  (£xr), 
and  the  decision  criterions  for  the  components  e  define  in  the  event  space  subsets  K 
where  a  kill  of  the  elementary  system  components  is  possible.  Actually,  because 
we  compute  the  possibility  as  well  as  the  necessity  of  a  kill,  and  assume  a  fuzzy 
decision  criterion  we  have  two  such  subsets  which  we  call  Afj]  and  Kn,  respectively. 
(If  the  criterion  is  crisp,  then  the  two  subsets  are  crisp  and  identical).  The 
possibility  that  a  fuzzy  event  g  corresponds  to  a  kill  of  e  is  in  terms  of  the  initial 
state  5(0)  of  the  component  and  the  possibility  II  ^  that  gttfjj  g'ven  by  the  formula 


8 


(3.1) 


n£>(g)  =  i  -s(0)(f)  (i  -  n*(?)) 

The  necessity  that  the  event  corresponds  to  a  kill  of  e  is 

=  1  -  S(0)(e)  (  1  -  Njc(g)  )  ,  (3.2) 

where  N*  is  the  degree  of  necessity  that  giK^.  Hence,  after  the  application  of  a 
threat  (pairing  the  initial  state  of  the  system  with  a  threat),  the  state  of  each 
elementary  system  component  is  characterized  by  two  numbers  II  and  Nj^  in  the 
interval  [0,1]  instead  of  the  one  binary  state  indicator  S'°\  If  everything  is  crisp 
then  eqs.  (3.1)  and  (3.2)  reduce  to  eq.  (2.3)  and  the  new  state  of  the  system  is 
indicated  by  the  binary  state  vector  S^\  The  possibilistic  indicators  provide 
additional  information,  in  essence  telling  one  how  close  the  event  is  to  a  threshold 
of  damage. 

The  degrees  of  possibility  and  necessity  of  killing  a  higher  level  component  / 
are  calculated  in  two  steps.  First,  the  results  at  the  elementary  level  are  aggregated 
to  obtain  transfer  values  and  N ^  for  the  higher  level  component.  Then,  these 
quantities  are  used  in  equations  (3.1)  and  (3.2)  to  calculate  the  possibility  measures 
for  /.  The  transfer  values  are  obtained  as  follows. 

Let  be  the  event  in  terms  of  the  component  and  threat  combination 

for  a  higher  level  component  with  the  parameter  /.  For  simplicity  we  omit  the  tilde 
which  indicates  fuzziness  and  assume  from  now  on  that  all  entities  can  be  either 
crisp  or  fuzzy.  The  aggregation  of  the  transfer  functions  depends  on  the  type  of 
dependency  of  /  on  the  elementary  components  e.  The  simplest  rules  of 
aggregation  are  those  for  a  pure  conjunction  and  pure  disjunction.  If  the 
aggregation  of  elementary  system  components  to  the  next  level  is  a  conjunction 
(component  /  is  killed  if  all  components  e\  through  em  are  killed)  then  the  transfer 
values  of  the  possibility  and  the  necessity  are  aggregated  by  min  operations 
(Ref.  3,  p.  318): 


n*(<?)  = 

min  np(g()  , 

(3.3) 

n*0?)  = 

min  NjPta,-)  . 
i  =  1,. . . 

(3.4) 

If  the  aggregation  is  disjunctive  (/  is  killed  if  either  of  the  components  ty  through 
er  is  killed),  then  the  max  operator  is  used: 

n*(?)  =  max  n^(g,)  ,  (3.5) 

i  =  1 . r 
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(3.6) 


N  *(«)  =  max  N^(g,) 

i  = 

In  practical  applications,  one  needs  more  flexibility  than  provided  by  these 
standard  aggregations.  Such  a  flexibility  is  obtained  by  attaching  weights  to  the 
lower  level  results,  whereby  the  weights  express  the  relative  importance  of  a  kill  of 
elementary  level  components  for  the  kill  of  a  higher  level  component. 

Let  ejt  i=l,...,n  be  the  set  of  all  elementary  system  components  and  g,  be  the 
corresponding  elements  of  the  event  space.  Let  *^[0,1]  be  weights  expressing  the 
relative  importance  of  the  decision  function  C,,  that  is  of  the  state  of  the  element 
eh  for  the  aggregation  with  respect  to  the  higher  level  component  /.  (A  larger 
weight  means  that  the  killing  of  the  particular  component  is  more  important;  in 
terms  of  pattern  matching,  the  matching  of  a  component  with  a  larger  weight  is 
more  significant).  Let  the  weights  be  normalized  by 

max  w,  =  1  (3.7) 

i *  1 , n 

The  transfer  values  are  obtained  in  case  of  weighted  conjunction  by  the 


minimization  (Ref.  3,  p.322) 

n  jc(9)  = 

i 

min  max  {  1  -  w,- ,  U^(g,)  }  , 

=  1,  ...n 

(3-8) 

N  *(<?)  = 

I 

min  max  {  1-w,  ,  Np(g,)  }  . 

=  l,...,n 

(3.9) 

The  corresponding  aggregation  for  the  weighted  disjunction  is 

11*07)  = 

max  rain  {  w,  ,  II^1^,)  }  , 

i  =  1 .....  n 

(3.10) 

N K(q)  = 

max  min  {  w,  ,  N^1)(g1)  }  . 

i  =  1.....B 

(3.11) 

Eqs.  (3.7)  through  (3.11)  contain  the  unweighted  aggregations  as  a  special  case 
with  1 . 

The  degrees  of  possibility  and  necessity  that  /  is  killed  are  computed  from  the 
transfer  values  in  analogy  to  eqs.  (3.1)  and  (3.2)  by 

njt%)  =  1  -  UK(q))  (3.12) 

and 
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(3.13) 


N^O?)  =  1  -  S(0>(/)  (1  -  N*(?)) 

where  Sf0!(/)  is  the  initial  state  of  the  system  component/. 

The  weighted  aggregation  is  a  convenient  method  to  compute  different  kill 
categories  from  the  same  damage  state  of  the  elementary  components.  Thus,  the 
contribution  of  a  component  e,  or  subsystem  /,  to  a  firepower  kill  often  will  differ 
from  its  contribution  to  a  mobility  kill,  or  to  a  specific  mission  kill.  The  weighted 
aggregation  provides  more  flexibility  than  a  categorical  assignment  of  the 
components  to  groups  corresponding  either  to  "contribution"  or  to  "no 
contribution"  to  a  specific  type  of  kill. 

4.  Conclusions. 

In  vulnerability  analysis,  the  available  information  often  is  imprecise  but  not 
random,  for  instance  if  the  threat  or  the  target  is  a  future  system  or  when  one  seeks 
to  estimate  the  vulnerability  of  a  system  to  threats  within  a  finite  range.  The 
analysis  of  this  type  of  data  is  the  subject  of  possibility  theory  which  defines 
measures  for  the  possibility  and  the  necessity  that  an  approximately  described 
system  is  killed  in  the  presence  of  an  approximately  described  threat.  Of  these  two 
possibilistic  measures,  the  degree  of  necessity  is  more  importan*  for  applications  in 
vulnerability,  because  a  positive  necessity  measure  means  that  one  can  be  more  or 
less  certain  that  a  kill  takes  place. 

The  input  for  vulnerability  estimates  based  on  possibility  theory  consists  of 
approximately  given  threats  and  approximately  described  systems  in  addition  to 
approximate  decision  functions  for  the  damage  of  elementary  components  of  the 
system.  The  user  has  a  great  freedom  in  defining  the  uncertainties  and  the  theory 
takes  into  account  all  these  inaccuracies  in  a  semantically  correct  manner.  Equally 
flexible  is  the  aggregation  of  possibilistic  damage  indicators  of  elementary  system 
components  to  obtain  the  degrees  of  possibility  and  necessity  that  the  whole  system 
is  killed.  By  using  proper  weights  in  the  aggregation  process  one  can  obtain  the 
results  for  various  kill  categories  with  the  same  computer  program. 
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Fig-are  5.  Possibility  Measures  for  "Kill"  in  Case 
of  a  Fuzzy  Event  and  Crisp  Decision 
Bound. 
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